Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can even give attackers hidden, live control of the victim’s browser session.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a dark-themed GitHub page, Octocat logo, “Verified Publisher” badge, looks totally legit. But here’s the trick: instead of a download button, it tells you to paste a Terminal command. That’s the ClickFix move used to drop AmnesiaStealer on macOS. After you run it, a native macOS password box pops up, styled like an Installer. AmnesiaStealer keeps asking until it gets your real Mac password, then reuses it to unlock your keychain and even hijack your browser in the background. Aha test: if a GitHub page tells you to paste a Terminal command or a download triggers an odd password prompt, stop. Don’t enter it, screenshot it and report it to security.
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers report a new PamStealer variant that lures macOS users to a fake cryptocurrency wallet website and tricks them into running a script-based installer. The malware downloads a decryption tool and relies on a live server key exchange, making the real payload harder to analyze and helping…
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
